Bypassing WAFs for Fun and JS Injection with Parameter Pollution

Ethiack details bypassing a strict WAF on an ASP.NET application via HTTP parameter pollution, splitting a JavaScript payload across duplicate parameters to evade inspection and trigger XSS.